feat(sso): allow disabling SAML AuthnRequest signing per SSO configuration - #805
Conversation
…ation Descope always signs the SAML AuthnRequest it sends to a tenant's IdP. A few IdPs (NetIQ Access Manager among them) reject a signed request outright when their trusted-provider entry holds no signing certificate for Descope, and until now there was no way to opt out. Adds disableSignRequest to SSOSAMLSettings and SSOSAMLByMetadataSettings, and exposes the stored value on SSOSAMLSettingsResponse. Defaults to false, so every existing configuration keeps signing as it does today. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
🐕 Review complete — View session on Shuni Portal 🐾 🤖 Model: |
🐕 Suggested ReviewersReview Strategy: Prioritizing coverage of new SSO flags (types) and comprehensive test validation (sso.test.ts). Requesting input from a functional reviewer each for types changes (talaharoni/aviadl) and test changes (itaihanski).
Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best. |
![shuni-bot[bot]](https://avatars.githubusercontent.com/in/2536750?s=60&v=4){kind=small}
There was a problem hiding this comment.
🐕 Shuni Review
Adds an optional disableSignRequest flag to SSOSAMLSettings, SSOSAMLByMetadataSettings, and SSOSAMLSettingsResponse, purely additive typing with matching tests and a README example.
Actionable comments posted: 0
🧹 Nitpick comments: 1
Merge risk: 🟢 Low: additive optional field passed through as-is by existing configureSAMLSettings/configureSAMLByMetadata code, no logic changes required, and both variants are covered by new tests.
See inline comments for details.
🤖 Model: claude-sonnet-5
Review scope: Full review
Reviewed files (3)
README.mdlib/management/sso.test.tslib/management/types.ts
The object shorthand produced idpURL/entityID, but SSOSAMLSettings declares idpUrl/entityId, so the example did not compile when copied into real code. Rename the two declared variables so the shorthand yields the right property names, which fixes the snippet this PR added and the pre-existing one above it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
🐕 Review complete — View session on Shuni Portal 🐾 🤖 Model: |
2 participants
Description
Issue: https://github.com/descope/etc/issues/18144
go-sdk: descope/go-sdk#842 · python-sdk: descope/python-sdk#1684
Descope signs the SAML
AuthnRequestit sends to a tenant's IdP. A few IdPs (NetIQ Access Manager among them) reject a signed request outright when their trusted-provider entry holds no signing certificate for Descope, and until now there was no way to opt out.This exposes the new per-SSO-configuration flag:
disableSignRequest?: booleanonSSOSAMLSettingsandSSOSAMLByMetadataSettings.disableSignRequest?: booleanonSSOSAMLSettingsResponse, so the stored value is readable.The settings object is posted through as-is, so an omitted flag means the server default — signed — which is exactly the behavior every existing caller has today.